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SPECIFICATION 

TITLE OF INVENTION 
5 PPP/L2TP DOMAIN NAME PREAUTHORIZATION 

BACKGROUND OF THE INVENTION 

Cross Reference to Related Applications 
10 This application is related to the following: 

\f U.S. Patent Application Serial No. 09/488,394, filed January 20, 2000 in the name of 

H inventors Aravind Sitaramin, Aziz Abdul, Bernard Janes, Dennis Cox, John Joyce, Peter 

I' ' Heitman, Shujin Zhang and Rene Tio, entitled "System and Method for Identifying a 

j* Subscriber for Connection to a Communication Network", commonly assigned herewith. 

W 15 U.S. Patent Application Serial No. 09/488,395, filed January 20, 2000 in the name of 
^ inventors Aravind Sitaramin, Dennis Cox, John Joyce and Shujin Zhang, entitled 

"System and Method for Determining Subscriber Information", commonly assigned 

herewith. 

U.S. Patent Application Serial No. , filed November 13, 2000 in the name 

20 of inventors Purnam Sheth, Aravind Sitaraman, Charles Yager and Gregory Burns, 
entitled "PPP Domain Name and L2TP Tunnel Selection Configuration Override", 
commonly assigned herewith. 
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Field of the Invention 

The present invention relates to the field of data communications. More 
particularly, the present invention relates to a system and method for restricting the 
domains that a subscriber can visit when using Point-to-Point Protocol (PPP). 



The Background Art 

A significant concern of the individual private and public domains making up the 
Internet or any other system incorporating multiple networks is the ability to ensure that 
10 only those subscribers who are authorized to access the individual private and public 
domains within the comprehensive network have the capability to access such networks. 
Serious security risks are posed by the possibility of unauthorized users having the know- 
how and capability to invade the individual private and public domains within the 
network. 

15 

In today's networking environment, many privately owned domain sites exist on 
the Internet that allow access only to those individuals which have been granted the 
proper authorization. For example, these may include company owned private domains 
containing confidential information and, as such, the company may grant access only to 
20 those employed by the company, or they may be communities of interest (i.e. "pay-sites") 
that provide information only to those subscribers which subscribe to the privately owned 
domain. The subscriber who connects to the Internet, typically by means of an Internet 
Service Provider (ISP) or Telephone Company (Telco), may also possess the capability to 
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assume the identity of an authorized user. This capability heightens the potential for 
security violations. 



5 Additionally, it is becoming increasingly more prevalent for individual computer 

users to have the capability to remotely access privately owned intra networks. Such 
Virtual Private Networks (VPNs) allow the user to connect with the private intra network 
of the company from the user's residence by means of the telephone line or other 
convenient means. The inception of wireless remote connections have even made it 

10 possible for users to connect from almost any imaginable locale. The ability to connect 
remotely to individual private intra networks, once seen as a luxury, has become so 
commonplace that many working professionals require such access in order to 
accomplish their everyday job assignments. In many instances, remote users connect to 
privately owned intra networks through the same means that individuals connect to the 

15 Internet, typically Telcos or ISPs. VPNs are cost-effective because users can connect to 
the Internet locally and tunnel back to connect to corporate resources. This reduces 
overhead costs associated with traditional remote access methods. 

Figure 1 shows a simplified diagram of a computer user connected to a computer 
20 network 10 via a host computer 12 linked to an access point 14 which grants 

authorization to external networks or domains 16, 18 and 20. The potential for a network 
security violation is posed by the user having the capability through the access point 14 to 
reach or "Knock on the door" of home gateways 22, 24 and 26. 
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Still referring to Fig. 1, the user has access to the computer networks through a 
workstation or host computer 12. The host computer 12 has the capability to connect 
with the external networks through an access point 14. An access point 14 is essentially 
5 an external location capable of permitting authorized users to access external computer 
networks. Typically, the access point consists of a series of Network Access Servers 
(NASs) and other related hardware, software and/or firmware. An access point 14 may 
also include a modem pool (not shown) maintained by a Telephone Company (Telco) or 
an Internet Service Provider (ISP) which enables its authorized users or subscribers to 
10 obtain external network access through the host computer 12 which has the required dial- 
up connection capability. Those of ordinary skill in the art will recognize that other types 
of access methods may be provided by a Telcos or ISP such as frame relay, leased lines, 
ATM (Asynchronous Transfer Mode), ADSL (Asymmetric Digital Subscriber Line) and 
the like. 

15 

Typically, when the user desires to access a specified domain, such as the first 
privately owned secured domain site 16, the user runs a network logon application 
program on the host computer 12 which requires the user to input user identification and 
authorization information as a means of initiating access to the desired network. This 
20 information is then directed to the access point 14 where it is verified to ensure that the 
host user has the required authorization to permit access to the desired network. Once 
authorization is granted to the user, a connection is established via the access point 14 
with the home gateway 22 of the specified first privately owned secure domain site 16. 
The connection established may be a tunnel-based connection, such as L2TP (Layer Two 
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Tunneling Protocol) or L2F (Layer Two Forwarding), or an IP-based (Internet Protocol) 
connection, such as used with ATM or frame relay. The user of the host computer 12, 
having established such a connection, has the ongoing capability to access the specified 
5 domain until the connection is terminated either at the directive of the user or by error in 
data transmission. The access point 14 will typically have the capability to connect the 
user to various other privately owned secured domain sites, such as the second private 
domain site 18 or the public Internet 20. The user of the host computer 12 may use the 
PPP protocol to connect through the wholesaler networks to another Home Gateway. 

10 

Layer 2 Tunneling Protocol (L2TP) is used in many Virtual Private Networks 
(VPNs). An L2TP access concentrator (LAC) is a device that the client directly connects 
to and that tunnels Point-to-Point (PPP) frames to the L2TP network server (LNS). The 
LAC is the initiator of incoming calls and the receiver of outgoing calls. An L2TP 
15 network server (LNS) is the Termination point for an L2TP tunnel and the access point 
where PPP frames are processed and passed to higher layer protocols. The LNS handles 
the server side of the L2TP protocol. The LNS terminates calls arriving at any of the 
LAC's PPP interfaces, including asynchronous, synchronous and ISDN. The LNS is the 
initiator of outgoing calls and the receiver of incoming calls. 

20 

Figure 2 is a block diagram that illustrates an L2TP tunnel and how a user 
typically connects to a privately owned domain site such as a corporate intranet. Using 
L2TP tunneling, an L2TP access concentrator (LAC) 100 located at the ISP's point of 
presence (POP) 105 exchanges PPP messages 1 10 with remote users 1 15 and 
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communicates by way of L2TP requests and responses with the customer's L2TP network 
server (LNS) 120 to set up tunnels 125. The L2TP protocol passes protocol-level packets 
through the virtual tunnel 125 between end points of a point-to-point connection. Frames 
5 from remote users are accepted by the ISP's POP 105, stripped of any linked framing or 
transparency bytes, encapsulated in L2TP and forwarded over the appropriate tunnel 125. 
The customer's home gateway 120 accepts these L2TP frames, strips the L2TP 
encapsulation, and processes the incoming frames for the appropriate interface. 

10 Turning now to Fig. 3 a block diagram that illustrates the use of AAA servers in 

an L2TP tunneling network is presented. The selection of the L2TP tunnel 200 at the 
LAC 205 or NAS is typically determined by an authentication, authorization and 
accounting (AAA) server 210 based upon the structured username f uscrname ©domain ) 
in the PPP authentication packet. The AAA 210 looks up a service profile that matches 

15 the domain name string. The service profile includes the IP address of the L2TP network 
server (LNS) 215 and a password for the tunnel 200. Once tunnels are established, the 
LAC 205 forwards the subscriber's PPP session to the destination LNS 215 through the 
L2TP tunnel 200. The ISP or enterprise customer 220 receives new PPP sessions and 
authenticates the sessions using AAA server 225. Authenticated sessions are established 

20 on the LNS 215, while sessions that fail authentication are rejected. 

Present methods of establishing a tunnel allow an unauthorized user to reach or 
"Knock on the door" of another Home Gateway 215, merely by changing the domain 
name provided in the PPP authentication packet to the domain name of the intended 
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Home Gateway 215. In this scenario, all users having access to access point 205 would 
have the potential to reach the privately owned secured domain site. For example, a user 
having a domain name of xxx @corpA.com may change the domain name in the PPP 
5 authentication packet to xxx@corpB.com , allowing the user's PPP session to be 

forwarded to the corpB LNS through the L2TP tunnel assigned to corpB. Allowing such 
unauthorized access to a Home Gateway 215 subjects the Home Gateway 215 to potential 
security risks, including denial of service attacks. 

10 Denial-of-service attacks typically focus on making a service unavailable for 

normal use, which is often accomplished by exhausting a resource limitation on the 
network or within an operating system or application. When involving specific network 
server applications, these attacks can focus on acquiring and keeping open all of the 
available connections supported by that server, effectively locking out valid users of the 

15 server or service. For example, a user intending to exploit present day L2TP systems 
could flood the network with many PPP sessions targeted to a Home Gateway for which 
the user is not authorized. Although the LNS authentication process would typically 
prevent an unauthorized user from access to the corporate intranet, the resources devoted 
to handling the large number of PPP sessions could adversely affect the services available 

20 to authorized users. 



The currently available solutions to this problem are very limited and do not offer 
the level of security protection that most companies operating secured and confidential 
private intra networks demand. Companies have been able to minimize the risk by 
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setting up internal access points which effectively cause the user/host to dial-in or 
connect directly with the private intra network without going through an external ISP or 
Telco. While this direct-connect service allows some measure of security it does so at the 
5 expense of increasing the costs associated with maintaining an internal access point and 
the additional connection costs related to remote users having to potentially incur long 
distance telephone service charges. 

What is needed is a solution that provides more control over which domains a 
10 particular subscriber may connect to using the PPP protocol 
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BRIEF DESCRIPTION OF THE INVENTION 

A method for controlling subscriber access in a network capable of establishing 
5 connections with a plurality of domains includes receiving a communication from a 
subscriber using a first communication network coupled to at least one other 
communication network, the communication optionally including a domain identifier 
associated with a domain on the at least one other communication network, determining 
whether the subscriber is authorized to access the domain based upon the domain 

10 identifier and a list of authorized domains for a virtual circuit used to receive the 
communication and authorizing subscriber access to the domain when the domain 
identifier is included in the list. An access server includes a tunnel ID request generator 
and an authorizes The tunnel ID request generator generates a tunnel ID request that 
includes a virtual circuit identifier associated with a virtual circuit used to accept a PPP 

15 authentication request. The authorizer grants subscribers domain access based upon a list 
of authorized domains for the virtual circuit. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a block diagram of a computer network wherein the host computer has 
5 access to multiple domains within the network. 

Fig. 2 is a block diagram that illustrates an L2TP tunnel and how a user typically 
connects to a corporate intranet. 

10 Fig. 3 is a block diagram that illustrates the use of AAA servers in an L2TP 

tunneling network. 

Fig. 4 is a high-level block diagram of a differentiated computer network that has 
the capability to limit subscriber access to the system to any domain network selected 
15 from a list of domain networks associated with a virtual circuit in accordance with one 
embodiment of the present invention. 

Fig. 5 is a high-level flow diagram that illustrates a method for limiting subscriber 
access to any domain network selected from a list of domain networks associated with a 
20 virtual circuit in accordance with one embodiment of the present invention. 

Fig. 6 is a detailed block diagram of a differentiated computer network that has 
the capability to limit subscriber access to the system to any domain network selected 
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from a global list of domain networks associated with a virtual circuit in accordance with 
one embodiment of the present invention. 

5 Fig. 7 is a detailed flow diagram that illustrates a method for determining a tunnel 

ID based on a path ID and a PPP authentication request domain name in accordance with 
one embodiment of the present invention. 

Fig. 8 is a detailed block diagram of a differentiated computer network that has 
10 the capability to limit subscriber access to the system to any domain network selected 

from a global list of domain networks associated with a virtual circuit in accordance with 
one embodiment of the present invention. 

Fig. 9 is a detailed flow diagram that illustrates a method for determining a tunnel 
1 5 ID based on a path ID and a PPP authentication request domain name in accordance with 
one embodiment of the present invention. 

Fig. 10 is a detailed block diagram of a differentiated computer network that has 
the capability to limit subscriber access to the system to any domain network selected 
20 from a local list of domain networks associated with a virtual circuit in accordance with 
one embodiment of the present invention. 
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Fig. 1 1 is a detailed flow diagram that illustrates a method for determining a 
tunnel ID based on a path ID and a PPP authentication request domain name in 
accordance with one embodiment of the present invention. 

Fig. 12 is a table that illustrates associating virtual circuit identifiers with 
authorized domain names in accordance with one embodiment of the present invention. 

Fig. 13 is a table that illustrates associating domain names with tunnel identifiers 
in accordance with one embodiment of the present invention. 
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DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT 

Those of ordinary skill in the art will realize that the following description of the 
5 present invention is illustrative only and not in any way limiting. Other embodiments of 
the invention will readily suggest themselves to such skilled persons having the benefit of 
this disclosure. 

In accordance with a presently preferred embodiment of the present invention, the 
10 components, processes and/or data structures may be implemented using C++ programs 
running on high performance computers (such as an Enterprise 2000™ server running 
Sun Solaris™ as its operating system. The Enterprise 2000™ server and Sun Solaris™ 
operating system are products available from Sun Microsystems, Inc. of Mountain View, 
California). Different implementations may be used and may include other types of 
15 operating systems, computing platforms, computer programs, firmware and/or general 
purpose machines. In addition, those of ordinary skill in the art will readily recognize 
that devices of a less general purpose nature, such as hardwired devices, devices relying 
on FPGA (field programmable gate array) or ASIC (Application Specific Integrated 
Circuit) technology, or the like, may also be used without departing from the scope and 
20 spirit of the inventive concepts disclosed herein. 

The authentication, authorization and accounting (AAA) service performs user 
authentication, user authorization and user accounting functions. It may be a Cisco 
ACS™ product such as Cisco Secure™, available from Cisco Systems, Inc. of San lose, 
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California, or an equivalent product. In accordance with one embodiment of the present 
invention, the Remote Authentication Dial-In User Service (RADIUS) protocol is used as 
the communication protocol for carrying AAA information. RADIUS is an Internet 
5 standard track protocol for carrying authentication, authorization, accounting and 
configuration information between devices that desire to authenticate their links and a 
shared AAA or AAA proxy service. Those of ordinary skill in the art will realize that 
other authentication protocols such as TACACS+ or DIAMETER can be used as 
acceptable authentication communications links between the various communications 
10 devices that encompass the data communications network and still be within the 
inventive concepts disclosed herein. 



Turning now to Fig. 4, a block diagram that illustrates a communication system 
300 in accordance with one embodiment of the present invention is presented. Users 

15 connect to public or private domain networks within communication system 300 through 
host computers 305, 310 ; 315. The host computers 305, 310, 315 have the capability to 
connect or link with domain 320. Domain 320 may be a private domain or a public 
domain, such as the Internet or a private intra network. These links or connections are 
established via a series of hardware that serve to grant access to specific domains and 

20 transport data packets to and from the host computers 305, 3 10, 3 15 and domain 320. 



The host computers 305, 310, 315 in this particular computer network are 
connected to a Publicly Switched Telephone Network (PSTN) 325 via a transmission 
means 330, 335, 340, such as copper wire or cable. Broadcast mechanisms such as 
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ADSL (Asymmetric Digital Subscriber Line) may be used. Those of ordinary skill in the 
art will recognize that other types of broadcast mechanisms may be provided by an ISP or 
Telco such as Ethernet, frame relay, leased lines, ATM (Asynchronous Transfer Mode) 

5 or the like. Access points 345 are located within a wide area network (WAN) 350 and 
are operated by Telcos or ISPs. The access points 345 house AAA servers 355, Service 
Selection Gateways (not shown in Fig. 4), L2TP Access Concentrators (LACs) 360, 
Digital Subscriber Line Aggregation Multiplexers (DSLAMs) 365, 370, 375 or similar 
devices. The Service Selection Gateway (SSG) is not an integral part of the present 

10 invention and therefore a discussion related to their functionality would not benefit the 
discussion of the present invention. The SSG serves as a gateway between the user and 
public area domains, such as the Internet. In order for a user host to gain access to a 
public domain network, such as the Internet, users must first dial-in or otherwise make a 
connection with the SSG through a data-receiving interface (not shown in Fig. 5.). As a 

15 threshold matter, an authorizer (not shown in Fig. 5) within the LAC serves to 

authenticate the identity of the user, ensure authorization and ascertain the nature and 
scope of the public network services that it will provide. 

According to one embodiment of the present invention, an access point 345 
20 includes one or more DSLAMs 365, 370, 375 that service the copper loops between the 
access point 345 and the Customer Premises Equipment (CPE) 305, 310, 315. DSLAMs 
365, 370, 375 may link locally or via an inter-central office (CO) link to LAC 360. 
Traffic enters and exits the DSLAM chassis through ports, each of which is assigned a 
port address. A virtual circuit or channel (VC) is a logical circuit created to ensure 
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reliable communication between two network devices. A VC is defined by a Virtual Path 
Identifier (VPI) / Virtual Channel Identifier (VCI) pair, which is directly tied to a 
particular DSLAM port used by a particular subscriber. 

5 

The LAC 360 is linked to a separate server/memory device 355, herein referred to 
as an Authentication, Authorization and Accounting (AAA) server 355. The LAC 360 
and the AAA server 355 communicate with one-another according to the Remote Access 
Dial-In User Service (RADIUS) protocol. The specific details of the RADIUS protocol 

10 are well known by those of ordinary skill in the art. Moreover, as will be apparent to 
those of ordinary skill in the art, the RADIUS protocol has limited applicability to the 
present invention and, therefore a detailed discussion of this protocol is deemed 
unnecessary. The preferred methods of the present invention described herein are not 
limited to the use of the RADIUS protocol and other equivalent authentication protocols 

15 may be used. 



In accordance with one embodiment of the present invention, the LAC service 
and the LNS may be implemented using a Cisco 6400 Universal Access Concentrator, 
available from Cisco Systems, Inc. of San Jose, California. 

Turning now to Fig. 5, a high-level flow diagram that illustrates a method for 
limiting subscriber access to any domain network selected from a list of domain networks 
associated with a virtual circuit in accordance with one embodiment of the present 
invention is presented. At 500, a PPP session authentication request that includes a 
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domain name is received. At 505, a tunnel ID is determined, based upon the domain 
name and a virtual circuit identifier such as a VPWCD identifier. At 510, a 
determination is made regarding whether the domain name is authorized. If the domain 
5 name is unauthorized, the call is dropped at 515. If the domain is authorized, the PPP 
session is forwarded onto the tunnel at 520. 

Figures 6-11 illustrate three different embodiments of the present invention. 
Figures 6-7 and 8-9 illustrate two embodiments that maintain domain restriction data 
10 globally in an AAA server or similar device. The embodiment illustrated by Figures 6-7 
requires two message exchanges between an AAA server and a LAC device, while the 
embodiment illustrated by Figures 8-9 requires only one message exchange. Figures 10- 
1 1 illustrate an embodiment of the present invention that maintains domain restriction 
data locally in a LAC or similar device. 

15 

Turning now to Fig. 6, a detailed block diagram of a differentiated computer 
network that has the capability to limit subscriber access to the system to any domain 
network selected from a global list of domain networks associated with a virtual circuit in 
accordance with one embodiment of the present invention is presented. A first receiving 
20 interface 600 of LAC 605 receives a PPP authentication request 610. The PPP 

authentication request 610 includes a domain name 615. The request 610 is received at a 
particular DSLAM port associated with a virtual circuit identifier such as a VPI/VCI 
identifier. A domain list request generator 620 generates a domain list request packet and 
a first forwarding interface 625 sends a request packet to an AAA server 630. The packet 
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includes the virtual circuit identifier 635 associated with the virtual channel used to 
receive the PPP session 610. The AAA server 630 receives the domain list request 640, 
performs a table lookup using table 645 to obtain a list of authorized domain names 
5 associated with the virtual circuit ID and returns the list of authorized domain names 650. 
A second receiving interface 655 receives the list of authorized domain names 650. An 
assessor 660 determines whether the domain identifier 615 is in the list of authorized 
domain names 650. If the domain name 615 is not in the list of authorized domain names 
650, the call is dropped. If the domain name 615 is in the list of authorized domain 

10 names 650, a tunnel ID request generator 660 generates a tunnel ID request and a second 
forwarding interface 665 sends the tunnel ID request 670 to the AAA server 630. The 
tunnel ID request 670 includes the PPP authentication packet domain name 615. The 
AAA server 630 receives the tunnel ID request 670, performs a table lookup using table 
675 to obtain the tunnel ID associated with the PPP authentication packet domain name 

15 610 and returns the tunnel ID 680. A third receiving interface 685 receives the tunnel ID 
680. An authorizer 690 authorizes user access to the domain 610 when the assessor 660 
determines access is authorized and when a tunnel ID 680 is received. A third 
forwarding interface 690 forwards the PPP session 610 to the LNS 695 associated with 
the tunnel ID 680. 

20 

Turning now to Fig. 7, a detailed flow diagram that illustrates a method for 
determining a tunnel ID based on a path ID and a PPP authentication request domain 
name in accordance with one embodiment of the present invention is presented. Figure 7 
provides more detail for reference numeral 505 of Fig. 5. At 700, an authorized domain 
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list request including a virtual circuit ID is sent to an AAA server. At 705, a list of 
authorized domains for the virtual circuit ID is received. At 710, a determination is made 
regarding whether the PPP authentication request domain name is in the list of authorized 
5 domain names. If the domain name is not in the list, an indication that the domain name 
is unauthorized is made at 715. If the domain name is in the list, at 720, a tunnel ID 
request including the PPP authentication request domain name is sent to the AAA server. 
At 725, a tunnel ID associated with the PPP authentication request domain name is 
received. 

10 

Figures 8 and 9 illustrate another embodiment of the present invention that 
maintains domain restriction data globally in an AAA server or similar device. The 
embodiment requires only one message exchange between an LAC device and an AAA 
server. 

15 

Turning now to Fig. 8, a detailed block diagram of a differentiated computer 
network that has the capability to limit subscriber access to the system to any domain 
network selected from a global list of domain networks associated with a virtual circuit in 
accordance with one embodiment of the present invention is presented. A first receiving 
20 interface 800 of LAC 805 receives a PPP authentication request 810 that includes a 

domain name 850. The request 810 is received at a particular DSLAM port associated 
with a virtual circuit identifier 815 such as a VPI/VCI identifier. A tunnel ID request 
generator 820 generates a tunnel ID request 825 and a first forwarding interface 830 
sends the tunnel ID request 825 to the AAA server 835. The tunnel ID request 825 
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includes the virtual circuit ID 815 associated with the virtual circuit used to receive the 
PPP authentication request 810 and the domain name included in the PPP authentication 
request 850. An AAA server 835 receives the tunnel ID request 825 and performs a table 
5 lookup using table 840 to obtain a list of authorized domain names associated with the 
virtual circuit ID. An assessor 845 determines whether the domain name included in the 
PPP authentication request 850 is in the list of authorized domain names. If the domain 
name 850 is not in the list of authorized domain names, an indication that the domain 
access is unauthorized is made. If the domain name 850 is in the list of authorized 

10 domain names, the AAA server 835 performs a table lookup using table 855 to obtain the 
tunnel ID 860 associated with the PPP authentication packet domain name 850. The 
AAA server 835 returns the authorization indication 865 and the tunnel ID 860. A 
second receiving interface 870 receives the authorization indication 865 and tunnel ID 
860. An authorizer 875 authorizes user access to the domain 850 according to the 

15 authorization indication 865. A third forwarding interface 880 forwards the PPP session 
810 to the LNS 885 associated with the tunnel ID 860. If domain access is unauthorized, 
the call is dropped. 

Turning now to Fig. 9, a detailed flow diagram that illustrates a method for 
20 determining a tunnel ID based on a path ID and a PPP authentication request domain 

name in accordance with one embodiment of the present invention is presented. Figure 9 
provides more detail for reference numeral 505 of Fig. 5. At 900, a tunnel ID request 
including a virtual circuit identifier such as a VPWCI ID and the PPP authentication 
request domain name are sent to an AAA server. The AAA server determines whether 
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the subscriber access to the domain is authorized. If subscriber access is authorized, the 
AAA server determines the tunnel ID associated with the domain. At 905, the tunnel ID 
and an indication of whether the PPP authentication request domain name is authorized 
5 are received from the AAA server. 

Figures 10 and 1 1 illustrate an embodiment of the present invention that maintains 
domain restriction data locally in a LAC or similar device. Figure 10 is a detailed block 
diagram of a differentiated computer network that has the capability to limit subscriber 

10 access to the system to any domain network selected from a global list of domain 
networks associated with a virtual circuit in accordance with one embodiment of the 
present invention. A receiving interface 1000 of LAC 1005 receives a PPP authentication 
request 1010 that includes a domain name 1015. The PPP authentication request request 
1010 is received at a particular DSLAM port associated with a virtual circuit identifier 

15 1020 such as a VPFVCI identifier. An authorized domain list determiner 1025 performs 
a table lookup using table 1030 to obtain a list of authorized domain names associated 
with the virtual circuit ID 1020 associated with the virtual channel used to receive the 
PPP session 1010. An assessor 1035 determines whether the domain name 1015 included 
in the PPP authentication request 1010 is in the list of authorized domain names. If the 

20 domain name 1015 is not in the list of authorized domain names, the call is dropped. If 
the domain name 1015 is in the list of authorized domain names, a tunnel ID determiner 
1040 performs a table lookup using table 1045 to obtain the tunnel ID associated with the 
PPP authentication packet domain name 1015. An authorizer 1050 authorizes user access 
to the domain 1015 when the domain name 1015 is in the list of authorized domain 
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names. A forwarding interface 1055 forwards the PPP session 1010 to the LNS 1060 
associated with the tunnel ID. 



5 Turning now to Fig. 1 1 , a detailed flow diagram that illustrates a method for 

determining a tunnel ID based on a path ID and a PPP authentication request domain 
name in accordance with one embodiment of the present invention is presented. Figure 
1 1 provides more detail for reference numeral 505 of Fig. 5. At 1 100, a table lookup 
based on a virtual circuit ID such as a VPFVCI identifier is performed to obtain a list of 

10 authorized domain names associated with the virtual circuit ID. At 1 105, a determination 
is made regarding whether the PPP authentication request domain name is in the list of 
authorized domain names. If the domain name is not in the list, an indication that the 
domain name is unauthorized is made at 1 1 10. If the domain name is in the list, at 1 1 15, 
a table lookup based on the domain name is performed to obtain the tunnel ID associated 

1 5 with the domain name. 

Figures 12-13 are tables that illustrate tunnel configuration information that may 
be stored in a LAC, an AAA server, or other similar devices in accordance with 
embodiments of the present invention. Figure 12 is a table that illustrates associating 
20 virtual circuit identifiers 1200 with authorized domain names 1205 in accordance with 
one embodiment of the present invention. Figure 13 is a table that illustrates associating 
domain names 1300 with tunnel identifiers 1305 in accordance with one embodiment of 
the present invention. In the example, a port having a virtual circuit ID of 10/2 (1210) 
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may establish tunnels with corpA.com (1215, 1310) or corpB.com (1220, 1315), using 
tunnel IDs 1320 and 1325, respectively. 

5 According to embodiments of the present invention, the information contained in 

the tables illustrated in Figs. 12 and 13 is requested by the domain owner to be placed in 
AAA servers or LACs. It allows the service provider or wholesaler the capability to 
restrict which domains a PPP session originating from a particular DSLAM port may 
^ connect to. This provides added security to the owner of the private domain by lessening 

1 2 10 the likelihood of an unauthorized access to the home gateway of a corporate intranet. It 

s y 

f 3 also allows a wholesaler to charge service providers and subscribers based on which 

Ijfi domains are authorized. The service provider or wholesaler would have the control over 

H which ports are allocated to which domains and are, thus, limited to those domains. 

15 Although embodiments of the present invention is have been described with 

respect to virtual circuits in an ATM networking environment, it should be understood 
that a virtual circuit assigned to a subscriber in system may be defined in any suitable 
networking environment using any suitable communication technologies and protocols, 
without deviating from the scope of the present invention. 

20 

In accordance with a specific embodiment of the present invention, the 
components, process steps, and/or data structures are implemented using software. This 
implementation is not intended to be limiting in any way. Different implementations may 
be used and may include other types of operating systems, computing platforms, and/or 
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computer programs. In addition, those of ordinary skill in the art will readily recognize 
that devices of a less general purpose nature, such as hardwired devices, devices relying 
on FPGA (field programmable gate array) or ASIC (application specific integrated 
5 circuit) technology, or the like, may also be used without departing from the scope and 
spirit of the inventive concepts disclosed herewith. 

While embodiments and applications of this invention have been shown and 
described, it would be apparent to those skilled in the art having the benefit of this 
10 disclosure that many more modifications than mentioned above are possible without 
departing from the inventive concepts herein. The invention, therefore, is not to be 
restricted except in the spirit of the appended claims. 
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CLAIMS 



What is claimed is: 



5 1 . A method for controlling subscriber access in a network capable of establishing 
connections with a plurality of domains, comprising: 

receiving a communication from a subscriber using a first communication network 
coupled to at least one other communication network, said communication 
optionally including a domain identifier associated with a domain on said at least 
10 one other communication network; 

determining whether said subscriber is authorized to access said domain based upon 
said domain identifier and a list of authorized domains for a virtual circuit used 
to receive said communication; 
authorizing subscriber access to said domain when said domain identifier is included 
15 in said list. 



2. The method of claim 1, further comprising terminating said communication when 
said domain identifier is not included in said list. 

20 3. The method of claim 1 wherein said communication comprises a Point-to-Point 
Protocol (PPP) session. 

4. The method of claim 3 wherein 

said PPP session comprises a tunneling session; 
25 said determining further comprises assigning a tunnel ID; and 
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said PPP session is forwarded onto a tunnel associated with said tunnel ID when said 
subscriber is authorized to access said domain. 

5 5. The method of claim 4 wherein said tunneling session comprises an L2TP session. 

6. The method of claim 5 wherein said determining further comprises: 
issuing an authorized domain list request including a virtual circuit identifier; 
receiving an authorized domain list that includes authorized domains for said 

10 identifier; 

indicating said domain is unauthorized when said domain name is not in said domain 
list; 

indicating said domain is authorized when said domain name is in said domain list; 
issuing a tunnel ID request including said domain name when said domain name is 
15 authorized; and 

receiving a tunnel ID. 

7. The method of claim 6 wherein 

said authorized domain list request is serviced by an AAA server; and 
20 an AAA server services said tunnel ID request. 

8. The method of claim 6 wherein said virtual circuit identifier comprises a VPI/VCI 
identifier. 
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9. The method of claim 5 wherein said determining further comprises: 
issuing a tunnel ID request including said domain name and a virtual circuit 

identifier; and 
receiving a tunnel ID. 

10. The method of claim 9 wherein an AAA server services said tunnel ID request. 

1 1 . The method of claim 9 wherein said virtual circuit identifier comprises a VPI/VCI 
identifier. 

12. The method of claim 5 wherein said determining further comprises: 

performing a table lookup based on a virtual circuit identifier to obtain an authorized 
domain list that includes authorized domains for said virtual circuit identifier; 

indicating said domain is unauthorized when said domain name is not in said 
authorized domain list; 

indicating said domain is authorized when said domain name is in said authorized 
domain list; and 

performing a table lookup based on said domain name to obtain a tunnel ID when 
said domain name is authorized. 

13. The method of claim 12 wherein said virtual circuit identifier comprises a VPI/VCI 
identifier. 

14. A program storage device readable by a machine, embodying a program of 
instructions executable by the machine to perform a method to control subscriber 
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access in a network capable of establishing connections with a plurality of domains, 
the method comprising: 

receiving a communication from a subscriber using a first communication network 
5 coupled to at least one other communication network, said communication 

optionally including a domain identifier associated with a domain on said at least 
one other communication network; 
determining whether said subscriber is authorized to access said domain based upon 
said domain identifier and a list of authorized domains for a virtual circuit used 
10 to receive said communication; 

authorizing subscriber access to said domain when said domain identifier is included 
in said list. 

15. The program storage device of claim 14, further comprising terminating said 
15 communication when said domain identifier is not included in said list. 

16. The program storage device of claim 14 wherein said communication comprises a 
Point-to-Point Protocol (PPP) session. 

20 17. The program storage device of claim 16 wherein 
said PPP session comprises a tunneling session; 
said determining further comprises assigning a tunnel ID; and 

said PPP session is forwarded onto a tunnel associated with said tunnel ID when said 
subscriber is authorized to access said domain. 

25 
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18. The program storage device of claim 17 wherein said tunneling session comprises an 
L2TP session. 

5 19. The program storage device of claim 18 wherein said determining further comprises: 
issuing an authorized domain list request including a virtual circuit identifier; 
receiving an authorized domain list that includes authorized domains for said 
identifier; 

indicating said domain is unauthorized when said domain name is not in said domain 
10 list; 

indicating said domain is authorized when said domain name is in said domain list; 
issuing a tunnel ID request including said domain name when said domain name is 

authorized; and 
receiving a tunnel ID. 

15 

20. The program storage device of claim 19 wherein 

said authorized domain list request is serviced by an AAA server; and 
an AAA server services said tunnel ID request. 

20 21. The program storage device of claim 19 wherein said virtual circuit identifier 
comprises a VPWCI identifier. 

22. The program storage device of claim 18 wherein said determining further comprises: 
issuing a tunnel ID request including said domain name and a virtual circuit 
25 identifier; and 

receiving a tunnel ID. 
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23. The program storage device of claim 22 wherein an AAA server services said tunnel 
ID request. 

5 

24. The program storage device of claim 22 wherein said virtual circuit identifier 
comprises a VPFVCI identifier. 

25. The program storage device of claim 18 wherein said determining further comprises: 
10 performing a table lookup based on a virtual circuit identifier to obtain an authorized 

domain list that includes authorized domains for said virtual circuit identifier; 
indicating said domain is unauthorized when said domain name is not in said 

authorized domain list; 
indicating said domain is authorized when said domain name is in said authorized 
15 domain list; and 

performing a table lookup based on said domain name to obtain a tunnel ID when 

said domain name is authorized. 

26. The program storage device of claim 25 wherein said virtual circuit identifier 
20 comprises a VPWCI identifier. 

27. An apparatus for controlling subscriber access in a network capable of establishing 
connections with a plurality of domains, the apparatus comprising: 

means for receiving a communication from a subscriber using a first communication 
25 network coupled to at least one other communication network, said 

communication optionally including a domain identifier associated with a 
domain on said at least one other communication network; 
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means for determining whether said subscriber is authorized to access said domain 
based upon said domain identifier and a list of authorized domains for a virtual 
circuit used to receive said communication; 
5 means for authorizing subscriber access to said domain when said domain identifier is 
included in said list. 

28. The apparatus of claim 27, further comprising means for terminating said 
communication when said domain identifier is not included in said list. 

10 

29. The apparatus of claim 27 wherein said communication comprises a Point-to-Point 
Protocol (PPP) session. 

30. The apparatus of claim 29 wherein 

15 said PPP session comprises a tunneling session; 

said determining further comprises means for assigning a tunnel ID; and 
said PPP session is forwarded onto a tunnel associated with said tunnel ID when said 
subscriber is authorized to access said domain. 

20 31. The apparatus of claim 30 wherein said tunneling session comprises an L2TP session. 

32. The apparatus of claim 29 wherein said determining further comprises: 

means for issuing an authorized domain list request including a virtual circuit 
identifier; 

25 means for receiving an authorized domain list that includes authorized domains for 

said identifier; 
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means for indicating said domain is unauthorized when said domain name is not in 
said domain list; 

means for indicating said domain is authorized when said domain name is in said 
5 domain list; 

means for issuing a tunnel ID request including said domain name when said domain 

name is authorized; and 
means for receiving a tunnel ID. 

10 33. The apparatus of claim 32 wherein 

said authorized domain list request is serviced by an AAA server; and 
an AAA server services said tunnel ID request. 

34. The apparatus of claim 32 wherein said virtual circuit identifier comprises a VPI/VCI 
15 identifier. 

35. The apparatus of claim 31 wherein said determining further comprises: 
means for issuing a tunnel ID request including said domain name and a virtual 

circuit identifier; and 
20 means for receiving a tunnel ED. 

36. The apparatus of claim 35 wherein an AAA server services said tunnel ED request. 

37. The apparatus of claim 35 wherein said virtual circuit identifier comprises a VPWCI 
25 identifier. 
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38. The apparatus of claim 31 wherein said determining further comprises: 

means for performing a table lookup based on a virtual circuit identifier to obtain an 
authorized domain list that includes authorized domains for said virtual circuit 
5 identifier; 

means for indicating said domain is unauthorized when said domain name is not in 

said authorized domain list; 
means for indicating said domain is authorized when said domain name is in said 
authorized domain list; and 
10 means for performing a table lookup based on said domain name to obtain a tunnel ID 

when said domain name is authorized. 

39. The apparatus of claim 38 wherein said virtual circuit identifier comprises a VPWCI 
identifier. 

15 

40. An access server capable of forcing subscribers of a communications system to gain 
access exclusively to a domain network associated with a virtual circuit, said access 
server comprising; 

an authorized domain list request generator capable of generating an authorized 
20 domain list request including a virtual circuit identifier associated with a virtual 

circuit used to accept a PPP session authentication request, said PPP session 

authentication request including a domain identifier; 
an assessor capable of determining whether said domain identifier is in said domain 

list; 
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a tunnel ID request generator capable of generating a tunnel ID request including said 

domain identifier; and 
an authorizer capable of granting users domain access based upon said authorized 

domain list. 

41. The access server of claim 40, further comprising: 

a first receiving interface capable of accepting said PPP session authentication 
request; 

a first forwarding interface capable of sending said authorized domain list request to 
an AAA server; 

a second receiving interface capable of accepting a requested authorized domain list; 
a second forwarding interface capable of sending said tunnel ID request to an AAA 
server; 

a third receiving interface capable of accepting a requested tunnel ID; and 
a third forwarding interface capable of forwarding said PPP session on a tunneling 
session associated with said tunnel ID. 

42. The access server of claim 40 wherein said tunneling session comprises an L2TP 
session. 

43. The access server of claim 42 wherein said virtual circuit identifier comprises a 
Virtual Path Identifier (VPI) / Virtual Channel Identifier (VCI). 
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44. The access server of claim 43 wherein said first receiving interface comprises at least 
one access multiplexer, each access multiplexer having a plurality of inputs for 
receiving a service request, each of said inputs being associated with a particular 
subscriber virtual circuit. 

45. The access server of claim 41 wherein said AAA server and said access server 
communicate using the Remote Authorization Dial-In User Service (RADIUS) 
protocol. 

46. An access server capable of forcing subscribers of a communications system to gain 
access exclusively to a domain network associated with a virtual circuit, said access 
server comprising: 

a tunnel ID request generator capable of generating a tunnel ID request, said tunnel 
ID request including a virtual circuit identifier associated with a virtual circuit 
used to accept a PPP authentication request; and 

an authorizer capable of granting users domain access based upon a list of authorized 
domains for said virtual circuit. 

47. The access server of claim 46, further comprising: 

a first receiving interface capable of accepting said PPP session authentication 
request, said PPP session authentication request including a domain identifier; 

a first forwarding interface capable of sending said tunnel ID request to an AAA 
server; 
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a second receiving interface capable of accepting a requested tunnel ID; and 
a second forwarding interface capable of forwarding said PPP session on a tunneling 
session associated with said tunnel ID. 

48. The access server of claim 47 wherein said tunneling session comprises an L2TP 
session. 

49. The access server of claim 48 wherein said virtual circuit identifier comprises a 
Virtual Path Identifier (VPI) / Virtual Channel Identifier (VCI). 

50. The access server of claim 46 wherein said first receiving interface comprises at least 
one access multiplexer, each access multiplexer having a plurality of inputs for 
receiving a service request, each of said inputs being associated with a particular 
subscriber virtual circuit. 

51. The access server of claim 47 wherein said AAA server and said access server 
communicate using the Remote Authorization Dial-In User Service (RADIUS) 
protocol. 

52. An access server capable of forcing subscribers of a communications system to gain 
access exclusively to a domain network associated with a virtual circuit, said access 
server comprising: 

a memory device capable of storing a domain list table and a tunnel ID table, said 
domain list table including a plurality of virtual circuit identifiers and associated 
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domain identifiers, said tunnel ID table including a plurality of domain names 

and associated tunnel IDs; 
an authorized domain list determiner capable of determining an authorized domain 
5 list based upon said domain list table and a domain identifier within a PPP 

authentication request, said PPP authentication request received on a virtual 

circuit having a virtual circuit identifier; 
an assessor capable of determining whether said domain identifier is in said domain 

list; 

10 a tunnel ID determiner capable of determining a tunnel ID based upon said tunnel ID 

table and said domain identifier; and 
an authorizer capable of granting subscribers domain access based upon said 
authorized domain list. 

15 53. The access server of claim 51, further comprising: 

a receiving interface capable of accepting said PPP session authentication request; 
and 

a forwarding interface capable of forwarding said PPP session on a tunneling session 
associated with said tunnel ID. 

20 

54. The access server of claim 53 wherein said tunneling session comprises an L2TP 
session. 
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The access server of claim 54 wherein said virtual circuit identifier comprises a 
Virtual Path Identifier (VPI) / Virtual Channel Identifier (VCI). 

The access server of claim 52 wherein said first receiving interface comprises at least 
one access multiplexer, each access multiplexer having a plurality of inputs for 
receiving a service request, each of said inputs being associated with a particular 
subscriber virtual circuit. 
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ABSTRACT OF THE DISCLOSURE 

A method for controlling subscriber access in a network capable of establishing 
5 connections with a plurality of domains includes receiving a communication from a 
subscriber using a first communication network coupled to at least one other 
communication network, the communication optionally including a domain identifier 
associated with a domain on the at least one other communication network, determining 
whether the subscriber is authorized to access the domain based upon the domain 
10 identifier and a list of authorized domains for a virtual circuit used to receive the 
communication and authorizing subscriber access to the domain when the domain 
identifier is included in the list. An access server includes a tunnel ID request generator 
and an authorizer. The tunnel ID request generator generates a tunnel ID request that 
includes a virtual circuit identifier associated with a virtual circuit used to accept a PPP 
15 authentication request. The authorizer grants subscribers domain access based upon a list 
of authorized domains for the virtual circuit. 



40 



EL575422540US 



Docket No. CISCO-3096 




Fig. 1 



EL575422540US 



CISCO3096 




EL575422540US 



CISCO-3096 




EL575422540US 



Docket No. CISCO-3096 



3 OO 




Fig. 4 



EL575422540US 



Docket No. CISCO-3096 



c 



Begin 



i 



Receive PPP Authentication 
Request Including Domain 
Name 



i 



Determine Tunnel ID Based 
On Virtual Circuit ID And PPP 
Authentication Request 
Domain Name 




goo 



GO 




£15 



Drop Call 



Forward PPP Session Onto 
Tunnel 



c 



End 



3 



Fig. 5 



EL575422540US 



Docket No. CISCO-3096 




© 



AAA 



Virtual Circuit 
ID to Domain 
List Table 



Domain to 
Tunnel ID 
Table 



■615 



is °, 



DO 



Wrtual 
Clffcuit ID 

1^ 



635 



© 



* Domain 
1 Mjst 



© 

Domain 




© 

Tunnel 
ID 

Request 



^5 ii 




Tunnel OO^ 
ID 



LACjfW&9 



Tunnel ID 
Request 
Generator 



Generator 



Domain List t~ 
Request ^-/^ 




Authorizer 



© ^ 

IT 



PPP Sessioi 
user@corpa.com 



LNS 




> 


<! 




Fig. 6 



EL575422540US 



Docket No. CISCO- 



/6etermine Tunnel ID based on Virtual 
( Circuit ID and PPP Authentication 
V Request Domain Name 



I 



Send Authorized Domain List 
Request To AAA Server 



loo 



Receive Authorized 
Domain List 



.7^ 




Fig. 7 



EL575422540US 



Docket No. CISCO-3096 




£3S 



®AAA /-s 
© 



Virtual Circuit 
ID to Domain 
List Table 



Domain to 
Tunnel ID 
Table 



Assessor 



7% 




Virtual 

Circuit ID 
-►I 



Tunnel ID 
Request 



©A 

Tunnel ID, 
Authorization 
Indication 



^ LAC ^ 



22° 



Tunnel ID 
Request 
Generator 


Authorizer 


7T^ 




215 %t° 



® 



PPP Session 
user@corpa.com 




Fig. 8 



EL575422540US 



Docket No. CISCO-3096 



Determine Tunnel ID based on Virtual" 
Circuit ID and PPP Authentication 
Request Domain Name 



Send Tunnel ID Request To AAA Server 



Receive Tunnel ID And Domain Name 
Authorization Indication 




End 



Fig. 9 



EL575422540US 

Docket No. CISCO-3096 





\ JVirtual 
COircuit ID 

S ! <~* 

2ii 



© 



LAC 



"V7 



Virtual Circuit 
ID to Domain 
List Table 




Domain to 
Tunnel ID 
Table 



Domain List 
Determiner 



Tunnel 3D 
Determiner 



Assessor 



Authorizer 



■1035 



PPP Session 
user@corpa.com 



(0 



idfS 



© 



K 




'1955 




Fig. 10 



EL575422540US 

Docket No. CiSCO-3096 



)etermine Tunnel ID based on Virtual 
Circuit ID and PPP Authentication 
Request Domain Name 



i 



Perform Table Lookup Based 
On Virtual Circuit ID To Obtain 
List Of Authorized Domains 






mo 



Indicate Unauthorized 
Domain Name 



Perform Table Lookup Based 
On PPP Authentication 
Request Domain Name To 
Obtain Tunnel ID 




End 



Fig. 11 



EL575422540US 



Docket No. CISCO-3096 




Virtual Circuit 
ID 




X1SL 



O 



33/1 



94/22 





(IPS 



Domain Name 



nnrhA.coiTfeorpB.com 



cor pA.com co t r nom corpC.com 



corpC.com 



f<% 12- 





13°° A^ Qly 




Domain Name 


Tunnel ID_ 


<corpA.com 


|4578J^L_^ 
3948 — -V= 


a corpB.com 
corpC.com 


9210 




Fig. 13 



